CVE-2026-107050

CriticalCVSS 9.8

Published: 29/10/2026(UTC)Updated: 04/11/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

41th percentile - higher than 41% of all known CVEs

Summary

An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code execution.

Risk Assessment

An attacker can execute arbitrary code in the victim's context, taking control of the app and potentially user data.

Recommendation

Update RetroArch to a version that fixes the issue and avoid loading untrusted content or configurations.

Other vulnerabilities in RetroArch

CVE-2021-28927High
In RetroArch 1.9.0 for Windows, the accessibility_speak_windows function in platform_win32.c passes unsanitized input to PowerShell, allowing attackers with write access to filesystems used by RetroArch to execute code via command injection using specially crafted file and directory names.

Original NVD description (English source)

An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code execution.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS